On July 14, Baylor’s cybersecurity team detected a compromised email account, and by the following afternoon, several additional accounts were compromised—all victims of what appears to be a coordinated phishing campaign.

These phishing messages call the recipient to immediate action (verify!) to prevent their email or Microsoft account from being deactivated. In each case, the verification link leads to an online form that requests a username and password (and possibly additional information depending on the link). The initiators of the phishing attack then use the username and password to get through the first layer of security on the email system. Once the account holder blindly authorizes a two-factor authentication notification, the attacker uses the email account to distribute as many additional email messages as they can before the exploit is detected and the email account is disabled.

The telltale signs of a phish are as follows:

• No official university marks or template
• Message A has a serious grammatical error (“verify this request otherwise give us reason”) and Message B asks the recipient to “verify this request” and then capitalizes “Verify” mid sentence with a link.
• The link does not route to an official university account, but an unknown domain. Still, don’t click links in messages.
• Both messages emphasize the submission of a password. No institution will ask you to report your account password in an environment where you are not actually logging onto a system.

On the night of June 11, 2025, Baylor faculty began to see and respond to the following phishing message. The tell-tale signs that this was a phishing message include:

• Call for immediate action to an immediate, personal concern.
• Sent from a non-Baylor email address (although in the longer tail of this phishing campaign, the emails were sent from compromised Baylor email accounts extending from the original phishing expedition)
• Lack of official university branding, especially on something of this nature.
• Use of a generic signature for what is clearly a direct and likely sensitive personnel-related matter.
• The fact that there is not an Office of Student-Faculty Relations nor an “Academic Standards Committee” (by that name) at Baylor. In addition, there wouldn’t be a “Compliance Division” to a Committee in Baylor’s organizational structure…or really any university structure. The signature line is essentially word soup.

Here is an example of the phishing message:

In this poorly written and edited phish, the assailant pretends to warn you about being part of a scam as a way to provoke you to divulge some personal information in anticipation of an egregiously large reward. Don’t fall for this nonsense…

—–Original Message—–
From: Elliott Harris <talibusman.40@gmail.com>
Sent: Monday, March 27, 2023 7:38 AM
Subject: Scammed Victim Compensation

This Email/Letter is been directed to you because your email address and country name was found in one of the scammer Artists file and computer hard-disk while the investigation, maybe you have been scammed. You are therefore being compensated with the sum of
US$350,000 (US$) (Three Hundred and Fifty Thousand United States Dollars).

We have arranged your payment to be paid to you directly to your bank account in your country or via a check. To receive the above fund, you are therefore advised to contact the PNC Bank, USA officer who will transfer the fund to your bank account from Reserve Bank. We have advised the Bank Agent to open a private email address with a new number as to enable us to monitor this payment and the transfer communications to avoid further delay or misdirection of your fund.

Kindly contact the PNC Bank officer now with the below contact details:

Contact: Mr E. William Parsley III
Chief Operations Officer
Contact Email: fedheadquarters1@gmail.com

Please send all replies to: fedheadquarters1@gmail.com

Contact him now and forward the below details to him:

1. Your Full Name:
2. Your Age:
3. Occupation:
4. Cell/Mobile Number:

Yours in Service.
MR. WILSON STEWART.
United Nations Funds Investigation Unit.

Please make sure you are a scam victim to respond to this Email if this mail come as an Error Ignore it and Delete Immediately

Phishing emails that share a link from Google Drive sharing an Evaluation document with you, usually it was targeting entire departments & either had the Dean or the University President’s name included to lend legitimacy – however, this email came from outside of Baylor (likely a compromised Google account). Click the link gave you a log in screen that looked like a legit Baylor site. Entering your credentials would allow the phishers attempts to access your Baylor email & would result in Duo pushes or phone calls arriving on your enrolled device. Please do NOT approve any Duo authentication that you did not initiate – always report them as fraud (if you are using Push, press Deny & it should give you the ‘Submit as Fraudulent’ option) or call the Help Desk & report that you are getting Duo authentication requests that you did not initiate. Below is a screen shot of the phishing email – you can see the subject line with the document name & its odd extension (.doc or .docx are the usually extensions for Word documents) & the fact that it came from Allison B, but mentions Linda Livingstone (it even warns you it is from outside of Baylor).

Best practices when you receive any email, whether you know it is legit or not are:

• Never click links in email or text messages.
• Never provide personal information, including passwords.
• Never authorize a Duo two-factor authentication request that you did not initiate.
• Forward suspicious emails to Abuse@Baylor.edu for analysis.